Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

41–50 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#41

Post by prettyStandard »

linuxlizard wrote: post #7
prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/

You can submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer

Re: What’s in a PR statement: LastPass breach explained

#43

Post by linuxlizard »

prettyStandard wrote: post #41
linuxlizard wrote: post #7

Earlier quoted context omitted.

Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/

You can submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer

Sorry. You did say that already. I will. Thank you!

Re: What’s in a PR statement: LastPass breach explained

#44

Post by palant »

Night_Thastus wrote: post #18

I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser password manager. It's an incredible convenience and it lets every service have a unique and nearly impossible to crack password. I have far too many services to remember them all, and using the same password for everything would be terrible. But of course I see the…

Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make...

This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone.

More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).

Re: What’s in a PR statement: LastPass breach explained

#45

Post by eric-burel »

hjuutilainen wrote: post #21
dariusm5 wrote: post #15

Earlier quoted context omitted.

I don't see any mention of local vaults on the page. Is there any password manager out there besides keepass that isn't cloud based?

There’s also Enpass ( https://www.enpass.io/ ) which markets itself as an offline password manager.

I use and like it

Re: What’s in a PR statement: LastPass breach explained

#46

Post by jxm262 »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

This is absolutely great. Thanks for sharing!

Re: What’s in a PR statement: LastPass breach explained

#47

Post by irrational »

rietta wrote: post #29
dgrin91 wrote: post #19

Earlier quoted context omitted.

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

Have to plan ahead and have the keypass password in an envelope in the safe deposit box.

What else is in your self deposit box? I thought only rich people with gold and jewels and spies with fake passports and ready currency used safe deposit boxes.

Re: What’s in a PR statement: LastPass breach explained

#49

Post by dkarl »

dgrin91 wrote: post #19
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

This is the reason I went with LastPass, because they have a feature designed and designated for recovery after death, with support, and 1Password would require me explaining to my family how they would use the emergency kit after I died, and they would likely 1) be pissed at being asked to understand it, and 2) not even try it after I died, and suffer all the inconvenience of not having access to my accounts.

It's frustrating, but the fact that 1Password's emergency kit is primarily intended and documented for me to use, and incidentally happens to enable account recovery for my heirs as well, means that they won't use it. One look at the documentation and they'll write it off as techie stuff that I was into that they won't be able to understand. With LastPass, there's stuff online specifically explaining that it's intended to provide access for family members in case of death, and I think that is reassuring enough that they'll stick with the process until they figure it out.

Re: What’s in a PR statement: LastPass breach explained

#50

Post by edflsafoiewq »

Night_Thastus wrote: post #18

I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser password manager. It's an incredible convenience and it lets every service have a unique and nearly impossible to crack password. I have far too many services to remember them all, and using the same password for everything would be terrible. But of course I see the…

I have a small script that does hash(key + masterPasswd). key is usually just the site's domain name. I have the script and a few of the important passwords (eg my email) written down on paper in case my drive dies. It works fine for me.
Post reply on HN